Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Add osuosl03

Browse source
This commit is contained in:
Kevin Fenzi 2014-07-09 21:26:28 +00:00
parent 31ac4a14d4
commit ba0af98867
4 changed files with 73 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
inventory/host_vars/osuosl03.fedoraproject.org Normal file
View file

@ -0,0 +1,3 @@
---
datacenter: osuosl
virthost: true

1
inventory/inventory
View file

@ -123,6 +123,7 @@ ibiblio04.fedoraproject.org
internetx01.fedoraproject.org
osuosl01.fedoraproject.org
osuosl02.fedoraproject.org
osuosl03.fedoraproject.org
serverbeach06.fedoraproject.org
serverbeach07.fedoraproject.org
serverbeach08.fedoraproject.org

2
playbooks/groups/virthost.yml
View file

@ -3,7 +3,7 @@
# NOTE: most of these vars_path come from group_vars/backup_server or from hostvars
- name: make virthost server system
hosts: virthost15.phx2.fedoraproject.org:bvirthost07.phx2.fedoraproject.org:buildvmhost-10.phx2.fedoraproject.org:buildvmhost-11.phx2.fedoraproject.org:buildvmhost-12.phx2.fedoraproject.org:virthost01.phx2.fedoraproject.org:virthost03.phx2.fedoraproject.org:ibiblio04.fedoraproject.org:bvirthost06.phx2.fedoraproject.org:bvirthost08.phx2.fedoraproject.org:bvirthost09.phx2.fedoraproject.org:bvirthost10.phx2.fedoraproject.org:bvirthost11.phx2.fedoraproject.org:virthost16.phx2.fedoraproject.org:virthost17.phx2.fedoraproject.org:virthost18.phx2.fedoraproject.org:serverbeach07.fedoraproject.org:qa07.qa.fedoraproject.org:coloamer01.fedoraproject.org:qa04.qa.fedoraproject.org:qa05.qa.fedoraproject.org
hosts: virthost15.phx2.fedoraproject.org:bvirthost07.phx2.fedoraproject.org:buildvmhost-10.phx2.fedoraproject.org:buildvmhost-11.phx2.fedoraproject.org:buildvmhost-12.phx2.fedoraproject.org:virthost01.phx2.fedoraproject.org:virthost03.phx2.fedoraproject.org:ibiblio04.fedoraproject.org:bvirthost06.phx2.fedoraproject.org:bvirthost08.phx2.fedoraproject.org:bvirthost09.phx2.fedoraproject.org:bvirthost10.phx2.fedoraproject.org:bvirthost11.phx2.fedoraproject.org:virthost16.phx2.fedoraproject.org:virthost17.phx2.fedoraproject.org:virthost18.phx2.fedoraproject.org:serverbeach07.fedoraproject.org:qa07.qa.fedoraproject.org:coloamer01.fedoraproject.org:qa04.qa.fedoraproject.org:qa05.qa.fedoraproject.org:osuosl03.fedoraproject.org
user: root
accelerate: "{{ accelerated }}"
gather_facts: True

68
roles/base/templates/iptables/iptables.osuosl Normal file
View file

@ -0,0 +1,68 @@
# {{ ansible_managed }}
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# allow ping and traceroute
-A INPUT -p icmp -j ACCEPT
# localhost is fine
-A INPUT -i lo -j ACCEPT
# Established connections allowed
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# allow ssh only from needed ips
# vpn in from tun0
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 192.168.0.0/24 -i tun0 -j ACCEPT
# external ip for phx2
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 209.132.181.0/24 -j ACCEPT
# external ip for scrye
-A INPUT -m conntrack --ctstate NEW -m tcp -p tcp --dport 22 -s 75.148.32.185 -j ACCEPT
# for fireball mode - allow port 5099 from lockbox and it's ips
-A INPUT -p tcp -m tcp --dport 5099 -s 192.168.1.58 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.126.23 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5099 -s 10.5.127.51 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5099 -s 209.132.181.6 -j ACCEPT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}
{% for port in tcp_ports %}
-A INPUT -p tcp -m tcp --dport {{ port }} -j ACCEPT
{% endfor %}
{% endif %}
# if the host/group defines incoming udp_ports - allow them
{% if udp_ports is defined %}
{% for port in udp_ports %}
-A INPUT -p udp -m udp --dport {{ port }} -j ACCEPT
{% endfor %}
{% endif %}
# if there are custom rules - put them in as-is
{% if custom_rules is defined %}
{% for rule in custom_rules %}
{{ rule }}
{% endfor %}
{% endif %}
# otherwise kick everything out
-A INPUT -j REJECT --reject-with icmp-host-prohibited
{% if virthost is defined %}
-A FORWARD -s 67.203.2.64/29 -j ACCEPT
-A FORWARD -d 67.203.2.64/29 -j ACCEPT
{% else %}
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
{% endif %}
COMMIT